# ANISIVO Partner API quickstart

The canonical contract is `https://api.anisivo.com/openapi.json`. Sandbox and production credentials are independent and secrets are shown once.

1. Create a Partner Organization and application in `https://developers.anisivo.com/console`.
2. Issue a sandbox credential with the minimum scopes needed.
3. Exchange it at `POST https://sandbox-api.anisivo.com/v1/oauth/token` using `client_credentials`.
4. Send the access token as `Authorization: Bearer …` and the approved clinic as `X-ANISIVO-Clinic-ID`.
5. Register a webhook, verify `X-ANISIVO-Signature`, reject timestamps older than five minutes, and deduplicate delivery IDs.
6. Review usage/rate limits, then submit a production-access request. A clinic administrator must approve every installation.

```bash
curl https://sandbox-api.anisivo.com/v1/oauth/token \
  -H 'content-type: application/json' \
  -d '{"grant_type":"client_credentials","client_id":"APP_UUID","client_secret":"an_test_…","environment":"sandbox","scope":"clinic:read appointments:read"}'
```

Never log credentials, access tokens, webhook secrets, request bodies, or patient data.